CVE-2026-12012: Use after free in Network in Google Chrome prior to 149

Synopsis

Use-after-free in the Network component of Google Chrome prior to version 149.0.7827.115 allows an attacker in a privileged network position to exploit heap corruption by sending malicious network traffic. No authentication or victim interaction is required, though the attacker must occupy a position on the network path between the victim and a remote server (for example, a compromised router, a malicious access point, or a VPN endpoint). Successful exploitation gives the attacker full read, write, and execution capability within the browser process, enabling data theft, content tampering, and arbitrary code execution. A patched-image rebuild at 149.0.7827.115 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must occupy a privileged position on the network path (for example, a compromised router, rogue access point, or VPN hop) to intercept or inject malicious traffic toward the target; AV:N/AC:H places this in the adjacent-to-path rather than arbitrary-internet category.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the exploit is delivered entirely through malicious network traffic.

• Victim interactionNot required

  The victim does not need to click a link, open a file, or take any other action for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must engineer or wait for specific network-path conditions (such as controlling a routing hop) rather than firing the exploit freely from any location.

Blast Radius

• Attacker reads memory contents of the browser process, including stored session tokens, autofill credentials, and in-flight request or response data.
• Attacker writes arbitrary data into heap memory, enabling modification of in-browser state such as rendered page content or cached resources.
• Heap corruption enables arbitrary code execution within the Chrome renderer or network service process at the privilege level of the browser.
• Full compromise of the affected service is possible, meaning the attacker can pivot from the corrupted process to further host-level attacks depending on sandbox escape capability.